Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson focuses on selecting AWS security services for common application, data-protection, identity, and hybrid-directory requirements. The key skill is mapping a stated requirement to the correct AWS integration pattern rather than selecting services in isolation.
Key Concepts
Protecting an Application Behind an Application Load Balancer
A typical HTTPS architecture for an application running on Amazon EC2 instances behind an Application Load Balancer (ALB) uses:
- Amazon Route 53 for DNS resolution.
- A Route 53 alias record pointing to the ALB.
- An HTTPS listener on the ALB.
- An SSL/TLS certificate issued and managed by AWS Certificate Manager (ACM).
- Security groups controlling network-level access to the ALB and targets.
- AWS WAF for HTTP-level filtering and web exploit protection.
The ACM certificate is associated with the ALB listener. Clients connect using the custom domain name, and the ALB terminates TLS before forwarding requests to the targets. The connection from the ALB to the targets can also be encrypted when end-to-end encryption is required.
A Route 53 alias record is preferred for AWS resources such as an ALB because it can point directly to the load balancer without requiring the administrator to manage changing IP addresses. Alias records are also supported at the zone apex, such as example.com.
AWS WAF for Web Exploits and Geographic Restrictions
AWS WAF uses a web ACL to inspect HTTP and HTTPS requests. A web ACL can be associated with an ALB and can contain rules for requirements such as:
- Common web exploit protection using AWS Managed Rules.
- IP address allowlists and blocklists.
- Rate-based protections.
- String, regular-expression, and header matching.
- Geographic matching based on the request source country.
For a requirement to block requests originating from specific countries, create a geographic match rule and configure the rule action to Block. WAF is an application-layer control; it does not replace security groups, network ACLs, or authentication.
AWS WAF geographic matching is based on the source IP address and geolocation databases. It is useful for broad geographic policy enforcement, but it should not be treated as a perfect identity or residency control.
Envelope Encryption with AWS KMS
AWS KMS is designed to protect and manage cryptographic keys, not to directly encrypt arbitrarily large files or data streams with a KMS key. For large data volumes, use envelope encryption:
- Generate a data encryption key (DEK) using a KMS key.
- Use the plaintext DEK locally or in the application to encrypt the data with a symmetric algorithm such as AES-GCM.
- Ask KMS to encrypt, or wrap, the DEK under the KMS key.
- Store the encrypted data and the encrypted DEK together.
- When decrypting, call KMS to decrypt the encrypted DEK, then use the resulting plaintext DEK to decrypt the data.
- Remove plaintext key material from memory when it is no longer needed.
This approach limits KMS operations to key generation and key wrapping while allowing the application to encrypt large objects efficiently. The KMS key policy and IAM permissions must allow the required cryptographic operations, such as GenerateDataKey and Decrypt.
The term customer managed key is the current terminology for a key that the customer creates and controls in AWS KMS. Older materials may refer to this as a customer master key, or CMK.
Cognito User Pools and Identity Pools
Amazon Cognito separates user authentication from AWS authorization:
- A Cognito user pool is a user directory and authentication service. It supports sign-up, sign-in, token issuance, and federation with social identity providers or other supported identity providers.
- A Cognito user pool hosted UI provides a prebuilt browser-based sign-in experience.
- A Cognito identity pool exchanges authenticated identities for temporary AWS credentials tied to IAM roles.
For a mobile application in which users authenticate through social identity providers and then need authorized access to AWS services, the common pattern is:
- Configure the social identity provider with a Cognito user pool or supported federation flow.
- Authenticate users through the user pool hosted UI or application integration.
- Configure an identity pool to trust the authenticated identities.
- Map authenticated users to an IAM role that grants only the required AWS permissions.
- Use the temporary credentials from the identity pool in the mobile application.
A user pool by itself issues tokens for application authentication; it does not automatically grant users temporary AWS credentials. An identity pool is needed when the application must call AWS services directly on behalf of the user.
Connecting EC2 Instances to an On-Premises Microsoft Active Directory
AWS Directory Service AD Connector acts as a directory proxy. It connects AWS applications to an existing on-premises Microsoft Active Directory without creating a new directory in AWS.
For EC2 instances to join the on-premises domain through AD Connector, the environment requires:
- Network connectivity between AWS and the on-premises network, commonly through AWS Direct Connect or a VPN.
- Correct routing in both directions.
- DNS resolution between AWS and the on-premises domain controllers.
- Security group and network ACL rules that permit required Active Directory and DNS traffic.
- An AD Connector deployed in the appropriate VPC subnets and availability zones.
- Credentials with sufficient permissions to join computers to the domain.
AD Connector is appropriate when the organization must continue using its existing on-premises directory. It does not store directory data independently in AWS and is not a replacement for the domain controllers.
Exam-Relevant Takeaways
- Use Route 53 alias records to point a custom domain to an ALB.
- Use an ACM certificate on the ALB HTTPS listener to provide TLS for client connections.
- Use an AWS WAF web ACL associated with the ALB to filter HTTP and HTTPS requests.
- Use a WAF geographic match rule to block or allow traffic by country.
- Use KMS envelope encryption and data encryption keys for large data volumes.
- A KMS key encrypts the data key; the data key encrypts the bulk data.
- Use a Cognito user pool for authentication, federation, and hosted UI capabilities.
- Add a Cognito identity pool when users need temporary IAM credentials to access AWS services.
- Use AD Connector to connect AWS workloads to an existing on-premises Active Directory.
- AD Connector requires functional network connectivity and DNS resolution to the on-premises directory.
Architecture Decision Guide
| Requirement | Recommended AWS design | Important distinction |
|---|---|---|
| Custom domain for an ALB-hosted application | Route 53 alias record to the ALB | The alias follows the AWS load balancer; no static ALB IP management is required |
| TLS for client connections to an ALB | ACM certificate attached to an ALB HTTPS listener | An ACM certificate alone does not encrypt traffic until associated with a listener or supported endpoint |
| Protection against common web exploits | AWS WAF web ACL on the ALB | WAF operates at the HTTP/HTTPS application layer |
| Block traffic from selected countries | WAF geographic match rule with a Block action | Country matching is based on source IP geolocation |
| Encrypt large files or datasets with KMS-controlled keys | Envelope encryption using a KMS-generated data key | Do not send the entire large dataset directly to KMS for encryption |
| Authenticate mobile users with social identity providers | Cognito user pool and federation | User pools handle application authentication and tokens |
| Give authenticated mobile users temporary AWS access | Cognito identity pool with IAM role mappings | Identity pools provide temporary AWS credentials |
| Join EC2 instances to an existing on-premises AD domain | AWS Directory Service AD Connector | Requires connectivity to existing domain controllers; it does not create a standalone directory |
Common Exam Traps
- Confusing Route 53 with certificate management: Route 53 provides DNS; ACM issues and manages certificates.
- Using a CNAME at the zone apex: Alias records are the standard choice for an ALB and work at the root domain.
- Treating WAF as a network firewall: WAF filters web requests. Security groups and network ACLs handle network-level controls.
- Encrypting large data directly with KMS: Use a KMS-generated data key and envelope encryption instead.
- Assuming a user pool provides AWS credentials: User pools authenticate users. Identity pools federate identities into temporary IAM credentials.
- Choosing Managed Microsoft AD when an existing on-premises directory must remain authoritative: AD Connector is the proxy pattern for that requirement.
- Ignoring hybrid connectivity for AD Connector: Direct Connect alone does not guarantee functionality; routing, DNS, and firewall rules must also be configured.
- Assuming WAF geographic restrictions provide strong user identity controls: Geolocation is an IP-based signal and can be inaccurate or bypassed through proxies and VPNs.
Real-World Engineer Notes
- Use separate WAF rules for managed protections, custom application rules, rate limiting, and geographic policies so each control can be tested and tuned independently.
- Begin WAF deployments in count mode where appropriate, review logs and false positives, and then move rules to blocking mode.
- Store encrypted data keys with the ciphertext, but protect the KMS key policy and application IAM role carefully. Access to the encrypted data alone should not be sufficient to decrypt it.
- Prefer least-privilege IAM roles for Cognito identity pools. Avoid giving every authenticated mobile user broad permissions to AWS services.
- For AD Connector, place connector endpoints in private subnets with resilient network paths to on-premises domain controllers. Validate DNS from the EC2 instances before troubleshooting domain joins.
- TLS termination at the ALB reduces application-server complexity, but regulated or highly sensitive workloads may also require encryption from the ALB to the targets.
Quick Reference Summary
- DNS: Route 53 alias record → ALB.
- Client encryption: ACM certificate → ALB HTTPS listener.
- Web request filtering: WAF web ACL → ALB.
- Country blocking: WAF geographic match rule → Block action.
- Large-volume encryption: KMS key → data encryption key → bulk data encryption.
- Application authentication: Cognito user pool.
- Temporary AWS access for mobile users: Cognito identity pool plus IAM roles.
- Existing on-premises AD integration: AD Connector plus Direct Connect or VPN, routing, and DNS.
Flashcards
- Q: Which AWS service provides a custom DNS name for an ALB?
A: Amazon Route 53, typically using an alias record pointing to the ALB.
- Q: Where is an ACM certificate attached when an ALB serves HTTPS traffic?
A: To the ALB HTTPS listener.
- Q: Which AWS service protects an ALB-hosted application from common web exploits?
A: AWS WAF using a web ACL associated with the ALB.
- Q: How can WAF block requests from selected countries?
A: Add a geographic match rule for those countries and configure the action as Block.
- Q: What is envelope encryption?
A: Encrypting bulk data with a data encryption key and encrypting that data key with a KMS key.
- Q: Why is envelope encryption used for large datasets?
A: KMS protects the key material while the application performs efficient bulk-data encryption locally.
- Q: What does a Cognito user pool provide?
A: User authentication, a user directory, federation, tokens, and an optional hosted UI.
- Q: What does a Cognito identity pool provide?
A: Temporary AWS credentials mapped to IAM roles for authenticated or, where configured, unauthenticated identities.
- Q: Which Cognito component is required when a mobile app must access AWS services directly?
A: A Cognito identity pool configured with suitable IAM roles.
- Q: What is the purpose of AD Connector?
A: To proxy authentication and directory operations between AWS applications and an existing on-premises Microsoft AD.
- Q: Does AD Connector create a separate directory database in AWS?
A: No. It connects AWS workloads to the existing on-premises directory.
- Q: What supporting capability is essential for EC2 domain joins through AD Connector?
A: Reliable network connectivity, routing, DNS resolution, and permitted directory traffic to the on-premises domain controllers.
Practice Questions
Question 1
A company hosts a web application on EC2 instances behind an ALB. The application must be accessible as app.example.com over HTTPS. Which combination satisfies the requirement with the least operational overhead?
A. Create an Elastic IP for each EC2 instance and upload a certificate to Route 53.
B. Create a Route 53 alias record to the ALB and associate an ACM certificate with the ALB HTTPS listener.
C. Create a Route 53 CNAME to an EC2 instance and install a certificate in IAM.
D. Create a network ACL allowing TCP 443 and use the ALB DNS name without a certificate.
Correct answer: B
Explanation: Route 53 provides the custom DNS record, while ACM provides the certificate that is attached to the ALB HTTPS listener. Network ACLs do not provide TLS encryption, and routing directly to EC2 bypasses the intended load-balancer architecture.
Question 2
An ALB-hosted application must block all requests originating from three countries and protect against common web exploits. What should a solutions architect recommend?
A. Add security-group rules for the countries and enable encryption at rest.
B. Create an AWS WAF web ACL with managed rules and a geographic match rule, then associate it with the ALB.
C. Configure Route 53 geolocation routing to return an error for those countries.
D. Use a network ACL with country-based rules.
Correct answer: B
Explanation: AWS WAF evaluates HTTP and HTTPS requests and supports both managed exploit-protection rules and geographic match rules. Security groups and network ACLs do not provide country-aware application-layer filtering.
Question 3
An application must encrypt multi-gigabyte objects using a customer-managed KMS key. Which approach is most appropriate?
A. Send each complete object to KMS for encryption.
B. Use the KMS key to generate a data encryption key, encrypt the object with the plaintext data key, and store the encrypted data key with the object.
C. Store the plaintext data key in Amazon S3 and use KMS only for authentication.
D. Use a security group to encrypt the data before writing it to storage.
Correct answer: B
Explanation: Envelope encryption is designed for large data volumes. The data encryption key performs the bulk encryption, while KMS protects the data key. The plaintext data key should not be persistently stored.
Question 4
A mobile application allows users to sign in with a social identity provider. After authentication, users must upload objects to a specific S3 prefix using temporary AWS credentials. Which design meets the requirement?
A. Cognito user pool only, with an S3 bucket policy allowing all authenticated users.
B. Cognito identity pool only, with no user authentication configuration.
C. Cognito user pool for authentication and federation, plus an identity pool that maps authenticated users to a least-privilege IAM role.
D. IAM users created for every mobile user, with long-term access keys embedded in the application.
Correct answer: C
Explanation: The user pool handles sign-in and federation. The identity pool exchanges the authenticated identity for temporary AWS credentials associated with an IAM role. Long-term credentials in a mobile application are insecure and should not be used.
Question 5
A company has Microsoft Active Directory on premises and has established Direct Connect to AWS. EC2 instances must join the existing domain without deploying a new directory in AWS. Which service should be used?
A. AWS Directory Service AD Connector
B. Amazon Cognito user pool
C. AWS IAM Identity Center only
D. Amazon Managed Microsoft AD with no connection to the on-premises directory
Correct answer: A
Explanation: AD Connector proxies directory requests to the existing on-premises AD and supports AWS workload integration without hosting a separate directory database in AWS. The design still requires valid routing, DNS, and firewall access across the hybrid connection.